CISM Exam Questions and Answers | Exam-Dumps (Page: 4)

QUESTION: 16

Which of the following is MOST appropriate for inclusion in an information security strategy?

Business controls designated as key controls
Security processes, methods, tools and techniques
Firewall rule sets, network defaults and intrusion detection system (IDS) settings
Budget estimates to acquire specific security tools

Answer(s): B

Explanation:

A set of security objectives, processes, methods, tools and techniques together constitute a security strategy. Although IT and business governance are intertwined, business controls may not be included in a security strategy. Budgets will generally not be included in an information security strategy. Additionally, until information security strategy is formulated and implemented, specific tools will not be identified and specific cost estimates will not be available. Firewall rule sets, network defaults and intrusion detection system (IDS) settings are technical details subject to periodic change, and are not appropriate content for a strategy document.

Reveal Solution Next Question

QUESTION: 17

Senior management commitment and support for information security will BEST be attained by an information security manager by emphasizing:

organizational risk.
organization wide metrics.
security needs.
the responsibilities of organizational units.

Answer(s): A

Explanation:

Information security exists to help the organization meet its objectives. The information security manager should identify information security needs based on organizational needs. Organizational or business risk should always take precedence. Involving each organizational unit in information security and establishing metrics to measure success will be viewed favorably by senior management after the overall organizational risk is identified.

Reveal Solution Next Question

QUESTION: 18

Which of the following roles would represent a conflict of interest for an information security manager?

Evaluation of third parties requesting connectivity
Assessment of the adequacy of disaster recovery plans
Final approval of information security policies
Monitoring adherence to physical security controls

Answer(s): C

Explanation:

Since management is ultimately responsible for information security, it should approve information security policy statements; the information security manager should not have final approval. Evaluation of third parties requesting access, assessment of disaster recovery plans and monitoring of compliance with physical security controls are acceptable practices and do not present any conflicts of interest.

Reveal Solution Next Question

QUESTION: 19

Which of the following situations must be corrected FIRST to ensure successful information security governance within an organization?

The information security department has difficulty filling vacancies.
The chief information officer (CIO) approves security policy changes.
The information security oversight committee only meets quarterly.
The data center manager has final signoff on all security projects.

Answer(s): D

Explanation:

A steering committee should be in place to approve all security projects. The fact that the data center manager has final signoff for all security projects indicates that a steering committee is not being used and that information security is relegated to a subordinate place in the organization. This would indicate a failure of information security governance. It is not inappropriate for an oversight or steering committee to meet quarterly. Similarly, it may be desirable to have the chief information officer (CIO) approve the security policy due to the size of the organization and frequency of updates. Difficulty in filling vacancies is not uncommon due to the shortage of good, qualified information security professionals.

Reveal Solution Next Question

QUESTION: 20

Which of the following requirements would have the lowest level of priority in information security?

Technical
Regulatory
Privacy
Business

Answer(s): A

Explanation:

Information security priorities may, at times, override technical specifications, which then must be rewritten to conform to minimum security standards. Regulatory and privacy requirements are government-mandated and, therefore, not subject to override. The needs of the business should always take precedence in deciding information security priorities.

Reveal Solution Next Question

ISACA CISM Exam (page: 4) ISACA Certified Information Security Manager Updated on: 25-Dec-2025

QUESTION: 16

Explanation:

QUESTION: 17

Explanation:

QUESTION: 18

Explanation:

QUESTION: 19

Explanation:

QUESTION: 20

Explanation:

ISACA CISM Exam (page: 4)
ISACA Certified Information Security Manager
Updated on: 25-Dec-2025